一句话:提出 EchoFuzz,用大语言模型缓解智能合约模糊测试中的状态转移逻辑鸿沟与变异序列冗余问题。
智能合约管理着万亿美元数字资产,是攻击的重点目标。模糊测试是检测漏洞的有效手段,但现有方法面临两大挑战:(1) 状态转移的逻辑鸿沟与组合冗余,导致难以权衡漏洞检测效率与状态空间探索成本,关键执行路径被忽视;(2) 基于规则的序列变异策略存在路径冗余且缺乏合约逻辑指导,使深度漏洞导向的探索陷入性能瓶颈。为此,该文提出 EchoFuzz,利用大语言模型赋能智能合约模糊测试。摘要仅阐述了问题与思路,未报告具体方法与实验结果。
Smart contracts, serving as the cornerstone of decentralized applications, autonomously manage trillion-dollar digital assets, making them attractive targets for attacks. Fuzzing has emerged as a promising technique for detecting vulnerabilities in smart contracts, yet existing methods face two main challenges. (1) The logical gap in state transitions and combinatorial redundancy hinders effective tradeoffs between bug detection efficiency and state space exploration cost, leading to critical execution paths to be overlooked. (2) Rule-based sequence mutation strategies suffer from path redundancy and inadequate guidance from contract logic, resulting in performance bottlenecks that stall the exploration of in-depth vulnerability-oriented paths.
@inproceedings{paperbot11674,
title = {EchoFuzz: Empowering Smart Contract Fuzzing with Large Language Models},
author = {Juanen Li and Peng Qian and Guanyan Li and Rui Wang and Peixin Wang and Zhiqing Tang and Fuchen Ma and Yuanliang Chen and Lun Zhang},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3773166}
}